How to encrypt a partition with Cryptoloop

1. Introduction

This article will describe how to encrypt entire partition with a Cryptoloop. Cryptoloop is a disk encryption module for Linux. It was first introduced in the 2.5.x kernel series. Cryptoloop has an ability to create an encrypted file system on a single partition or within a regular file, which can later simply be mounted by the mount command. Cryptoloop uses so called loopback device, which needs to be called with any file system request. Currently there are many alternatives for Cryptoloop usage and the most common is Loop-AES. This article will explain a simple usage of the cryptoloop module for partition encryption and mounting within a Linux Operating system.

2. Prerequisites

As it was already mentioned the cryptoloop module was introduced to Linux with the 2.5 kernel series. Therefore, the chances are that this module is already available on your system. To confirm that the cryptoloop module is available on your system run:

# lsmod | grep cryptoloopcryptoloop 12671 1

If no output has been produced that means that the module is unavailable and you will need to load it with:

# modprobe cryptoloop

Another tool, which we are going to need is losetup, which should be already a variable on your system.

3. Setting up a loopback device

Cryptoloop can be used to create an encrypted filesystem within the entire partition or single file. The procedure is the same for both of them. The only difference is the supplied argument either to be a path to a regular file or to block the device. As an example in this tutorial we will encrypt a block device /dev/sdb1.

First, we can make sure to overwrite entire partition with some random data. This step is optional but recommended.

WARNING: note that the below command will physically erase any data you may already have on your partition:

# dd if=/dev/urandom of=/dev/sdb1 bs=1M

Disregard any possible error message about a full disk space.

In the next step we need to choose a type of encryption. A list of encryption algorithm available on your system can be seen by the following command:

# cat /proc/crypto

We will use AES encryption algorithm. In the next step we use the losetup utility to attach our /dev/sdb1 block device to the system's loopback device /dev/loop0.

# losetup -e aes -k 256 /dev/loop0 /dev/sdb1Password:

You will be prompted to enter a password, which will be used to mount and unmount your partition. Choose a strong password right from the beginning as there is no easy way to change this password later.

4. Create a filesystem

At this point we should have our /dev/sdb1 partition attached to /dev/loop0 with AES 256 bit encryption. Next we use the /dev/loop0 device to create a filesystem. Feel free to use any type of filesystem you deem it to be worthy. I will use ext4:

# mkfs.ext4 /dev/loop0

5. Mounting Loopback device

To mount a loopback device in this case is as simple as mounting any other block devices. First, we need to create a mount point:

# mkdir /mnt/cryptoloop

Once ready, we use the mount command to mount /dev/loop0 as ext4 filesystem:

# mount -t ext4 /dev/loop0 /mnt/cryptoloop/

At this point we are able to navigate to /mnt/cryptoloop/ and store some data. For example, let's create a new file foo.txt:

# echo LinuxCareer.com > foo.txt

Once you finish using your new encypted filesystem you simply unmount it and detach it from a loopback device:

# umount /mnt/cryptoloop/# losetup -d /dev/loop0

After executing the above commands your data ( foo.txt ) will no longer be available.

6. Cryptoloop permanent mount

Once the new /dev/sdb1 file-system was created and encrypted with use of cryptoloop and the loopback device we can mount it again without use of the pseudo loopback device /dev/loop0.

To be able to mount off our encrypted partition easily with the simple mount command we need to add the following line into the /etc/fstab file:

/dev/sdb1 /mnt/cryptoloop ext4 noauto,encryption=aes

Now, we are able to mount this partition with:

# mount -a
OR
# mount /mnt/cryptoloop

7. Conclusion

You can find many other crypto utilities available on your Linux system. One worth to mention in conjunction to cryptoloop is its successor dm-crypt. Cryptoloop is part of Linux Crypto API since the kernel version 2.6.

Stay Tuned

Make sure you tune in to our Newsletter and Linux IT jobs portal to stay informed about the latest opportunities in the field. To help you to keep your skills sharp we also offer various Linux Training courses. Lastly, visit our Linux Forum if you want to share your Linux experiences with us or require additional help.

Author: Lubos Rendek

In the past I have worked for various companies as a Linux system administrator. Linux system has become my passion and obsession. I love to explore what Linux & GNU/Linux operating system has to offer and share that knowledge with everyone without obligations.

Partners

Who are we?

LinuxCareer.com is not affiliated with any local or international company, nor is it a recruitment or employment agency. We specialise in Linux based careers and closely related Information Technology fields by providing careers advice and latest employment opportunities.

JOIN LINUXCAREER

You can also get involved in the LinuxCareer project by participating on our FORUM or SUBMITTING A LINUX ARTICLE. We offer a range of privileges to our authors and good company.